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JTRIG tools and techniques 

(Redirected from JTRIG CITD - Covert Internet Technical Development) 
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[edit] JTRIG tools 
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We dont update this page anymore, it became somewhat of a Chinese menu for effects operations. Information is now available for JTRIG staff at [[1]^] 
[edit] Understanding this page 

Tools and techniques are developed by various teams within JTRIG. We like to let people know when we have something that we can think we can use, 
but we also dont want to oversell our capability. 

For this reason, each tool indicates its current status. We may put up experimental tools or ones that are still in development so you know what we are 
working on, and can approach JTRIG with any new ideas. But experimental tools by their nature will be unreliable, if you raise expectations or make 
external commitments before speaking to us you will probably end up looking stupid. 

Most of our tools are fully operational, tested and reliable. We will indicate when this is the case; however there can be reasons why our tools wont work 
for some operational requirements (eg if it exploits a provider specific vulnerability). There may also be legal restrictions. 

So please come and speak to JTRIG operational staff early in your operational planning process. 

[edit] Current Priorities 

Capability Development Priorities can be fond by following the link below 
■ CapDev Priorities (Discover) i| 



I[edit] Engineering 



Tool/System 


Description 


Status 


Contacts 


Cerberus 
Statistics 
Collection 


Collects on-going usage Information about how many users utilise 






JTRIG's UIA capability, what sites are the most frequently visited etc. 
This is in order to provide JTRIG infrastucture and ITServices 


OPERATIONAL 


JTRIG Software Developers ia 


management information statistics. 






JTRIG 








RADIANT 


is a 'Data Diode' connecting the CERBERUS network with GCNET 


OPERATIONAL 


JTRIG Software Developers 


SPLENDOUR 








ALLIUM ARCH 


JTRIG UIA via the Tor network. 


OPERATIONAL 


JTRIG Infrastructure Teamlia 


ASTRAL 
PROJECTION 


Remote GSM secure covert internet proxy using TOR hidden services. 


OPERATIONAL 


JTRIG Infrastructure Team [13 


TWILIGHT 
ARROW 


Remote GSM secure covert internet proxy using VPN services. 
JTRIG's new Infrastructure. FOREST WARRIOR, FRUIT BOWL, JAZZ 


OPERATIONAL 


JTRIG Infrastructure TeamlO 




PI I'^^IHM anri nthor 1TPIf^ cwctomc \A/ill form nart nf tho QPIPP IQI AKir^ 
rUOIkJI J aim ULlIci J 1 r\IO bybLciTIb Will lUilTl pd.lL Ul UIC Or Ik^C lOLrMNL/ 

infrastructure 


r^p\/ 

Ut V 


ITDI^ 1 nf ra eiri 1 1 ro Taam \—% 
J 1 rXIO iriira9l.i Ul^LUlc l caill k^fl 


POISON 
ARROW 


Safe Malware download capability. 

CERBERUS UIA Replacement and new tools infrastructure - Pnmary 


DESIGN 


JTRIG Infrastructure TeamlU 


FRUIT BOWL 


Domain for Generic User/Tools Access and TOR split into 3 sub- 
systems . 


DESIGN 


JTRIG Infrastructure TeamlO 


NUT ALLERGY 


JTRIG Tor web browser - Sandbox IE replacement and FRUIT BOWL 
sub-system 


PILOT 


JTRIG Infrastructure TeamlO 


BERRY 
TWISTER 


A sub-system of FRUIT BOWL 


PILOT 


JTRIG Infrastructure TeamlO 


BERRY 
TWISTER+ 


A sub-system of FRUIT BOWL 


PILOT 


JTRIG Infrastructure Team bJm 


BRANDY SNAP 


JTRIG UIA contingency at Scarborough. 


IMPLEMENTATION 


JTRIG Infrastructure Teamli3 


WIND FARM 


R&D offsite facility. 


DESIGN 


JTRIG Infrastructure Team 


CERBERUS 


JTRIG's legacy UIA desktop, soon to be replaced with FOREST 
WARRIOR. 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


BOMBAYROLL 


JTRIG's legacy UIA standalone capability. 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


JAZZ FUSION 


BOMBAY ROLL Replacement which will also incorporate new collectors 
- Primary Domain for Dedicated Connections split into 3 sub-systems. 


IMPLEMENTATION 


JTRIG Infrastructure TeamlO 


COUNTRY FILE 


A sub-system of JAZZ FUSION 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


TECHNO 
VIKING 


A sub-system of JAZZ FUSION 


DEoIGN 


JTRIG Infrastructure Team \^ 


JAZZ FUSION+ 


A sub-system of JAZZ FUSION 


DESIGN 


JTRIG Infrastructure TeamlO 


BUMBLEBEE 
DANCE 


JTRIG Operational VM/TOR architecture 


OPERATIONAL 


JTRIG Infrastructure Team tO 


AIR BAG 


JTRIG Laptop capability for field operations. 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


EXPOW 


GCHQ's UIA capability provided by JTRIG. 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


AXLE GREASE 


The covert banking link for CPG 


OPERATIONAL 


JTRIG Infrastructure TeamlO 


POD RACE 


JTRIG'S MS update farm 


DESIGN 


JTRIG Infrastructure Team lO 


WATCHTOWER GCNET -> CERBERUS Export Gateway Interface System 


OPERATIONAL 


JTRIG Software Developers lO 


REAPER 


CERBERUS -> GCNET Import Gateway Interface System 


OPERATIONAL 


JTRIG Software Developers lO 


DIALd 


External Internet Redial and Monitor Daemon 


OPERATIONAL 


JTRIG Software Developers lO 


FOREST 
WARRIOR 


Desktop replacement for CERBERUS 


DESIGN 


JTRIG Infrastructure TeamlO 


DOG HANDLER JTRIG's development network 


DESIGN 


JTRIG Infrastructure TeamlO 








JTRIG Infrastructure TeamlO 



DIRTY DEVIL JTRIG'S research network 



DESIGN 



[edit] Collection 



Tool 


Description 


Contacli 


Status 


AIRWOLF 


YouTube profile, comment and video collection. 


^^^^^^^1 Beta release. 


ANCESTRY 


Tool for discovering the creation date of yahoo selectors. 


JTRIG Software 
Developers 1^ 


Fully 

Operational. 


BEARTRAP 


Bulk retrieval of public BEBO profiles from member or group ID. 


JTRIG Software 
Developers 


Fully 

Operational. 


BIRDSONG 


Automated posting of Twitter updates. 


JTRIG Software 
Developers [13 


ripromi^^ionpfl 

Replaced by 
SYLVESTER. 


BIRDSTRIKE 


Twitter monitoring and profile collection. Click here for the User Guide. 


J 1 mo OUILWdlc 

Developers —1 


Piillv 
r uiiy 

Operational 


BUGSY 


Google+ collection (circles, profiles etc.) 


Tech Leads 


In early 




development. 


DANCING 


obtains the locations of WiFI access points. 


[Tech Lead:^^| 
^^HExpert 


Fully 


BEAR 


"userJ^^^HI 


Operational. 














[Tech Lead:|^^ 




DEVILS 


ECl Data Technique. 1 


^^^1 Expert 


Fully 


HANDSHAKE 




User^^^^^^l 


Operational. 










DRAGON'S 
SNOUT 




Tech Leads:^J 




Paltalk group chat collection. 




Beta release. 


EXCALIBUR 


acquires a Paltalk UID and/or email address from a Screen Name. 


JTRIG Software 
Developers liS 

[Tech Lead: 


Fully 

operational 

(against current 
Paltalk version) 


FATYAK 


Public data collection from Linkedln. 




In development 


FUSEWIRE 


Provides 24/7 monitoring of Vbulliten forums for target postings/online activity. Also allows 
staggered postings to be made. 


JTRIG Software 
Developers i3 




GLASSBACK 


Technique of getting a targets IP address by pretending to be a spammer and ringing them. 
Target does not need to answer. 


JTRIG Software 
Developers [13 


Fully 

operational. 






[Tech Lead: 


Fully 

rtnarof i Anal 
Upci dllUl Idl . 


GODFATHER 


Public data collection from Facebook. 








[Tech Lead: 


In Development 
(Supports 


GOODFELLA 


Generic framework for public data collection from Online Social Networks. 




RenRen and 
Xing). 


HACIENDA 


is a port scanning tool designed to scan an entire country or city. It uses GEOFUSION to 
identify IP locations. Banners and content are pulled back on certain ports. Content is put into 
the EARTHLING database, and all other scanned data is sent to GNE and is available through 
GLOBAL SURGE and Fleximart. 


NAC HACIENDA 
Taskers 


Fully 

operational. 


ICE 


is an advanced IP han/esting technique. 


JTRIG Software 
Developers \^ 




INSPECTOR 


Tool for monitoring domain information and site availability. 


JTRIG Software 
Developers 


Fully 

Operational. 


LANDING 
PARTY 


Tool for auditing dissemination of VIKING PILLAGE data. 


JTRIG Software 
Developers 


Fully 

Operational. 



MINIATURE 
HERO 


Active skype capability. Provision of real time call records (SkypeOut and SkypetoSkype) and 
bidirectional instant messaging. Also contact lists. 


JTRIG Software 
Developers ^ 


Fully 

operational, but 
note usage 
restrictions. 


MOUTH 


Tool for collection for downloading a user's files from Archive.org. 


JTRIG Software 
Developers S 


Fully 

Operational. 


MUSTANG 


provides covert access to the locations of GSM cell towers. 


[Tech Lead:^^| 
^^HExpert 


Fully 


User^^^^^H 


Operational. 


PHOTON 


A technique to actively grab the IP address of an MSN messenger user. 




Operational, but 

usage 

restrictions. 


TORPEDO 












RESERVOIR 


Facebook application allowing collection of various information. 


JTRIG Software 
Developers ^ 


Fully 

operational, but 

note operational 
restrictions. 






[Tech Lead:^^| 




SEBACIUM 


An ICTR developed system to identify P2P file sharing activity of Intelligence value. Logs are 




H Expert 




accessible via DIRTY RAT. 


User: 






SILVER 
SPECTER 


Allows batch Nmap scanning over TOR 


JTRIG boftware 
Developers i3 


In Development 


SODAWATER 


A tool for regularly downloading gmail messages and fonvarding them onto CERBERUS 
mailboxes 


JTRIG Software 
Developers ^ 


Fully 

Operational. 


SPRING 
BISHOP 


Find private photographs of targets on Facebook. 


Tech Lead: 




SYLVESTER 


Framework for automated interaction / alias management on online social networks. 


Tech Lead: 


In Development. 


TANNER 


A technical programme allowing operators to log on to a JTRIG website to grab IP addresses of 
Internet Cafe's. 


JTRIG 030^ 


Replaced by 
HAVOK. 


FIRE 


Mil UULUlTlcllL Llldl yidUo Lilc LaiycLS lYlaLillilc lillO, lllcOj lUyb^ cLL dllU [JUblb IL UdLK 10 

GCHQ. ' 


FIRE JTRIG ^ 


In Development. 


VIEWER 


A programme that (hopefully) provides advance tip off of the kidnappers IP address for HMG | 
personnel. 


[Tech Lead:^^| 
^^^^HExpert 
UserH^^^I 


Operational, but 
awaiting field 
trial. 


VIKING 
PILLAGE 


Distributed network for the automatic collection of encrypted/compressed data from remotely 
hosted JTRIG projects. 


PILLAGE JTRIG 
Software 
Developers 113 


Operational 


TOP HAT 


A version of the MUSTANG and DANCING BEAR techniques that allows us to pull back Cell 
Tower and WiFi locations targeted against particular areas. 


[Tech Lead: 


In development. 



[edit] Effects Capability 



JTRIG develop the majority of effects capability in GCHQ. A lot of this capability is developed on demand for specific operations and then further 
developed to provide weaponised capability. 

Dont treat this like a catalogue. If you dont see it here, it doesnt mean we cant build it. If you involve the JTRIG operational teams at the start of your 
operation, you have more of a chance that we will build something for you. 

For each of our tools we have indicated the state of the tool. We only advertise tools here that are either ready to fire or very close to being ready 
(operational requirements would re-prioritise our development). Once again, involve the JTRIG operational teams early. 



Tool 



ANGRY 
PIRATE 



Description 

is a tool that will permanently disable a target's account on their computer. 



Status 

Ready to fire (but 
see target 
restrictions). 



Contacts 

[Tech Lead: 




ARSON SAM 



Ready to fire (Not 

is a tool to test the effect of certain types of PDU SMS messages on phones / network. It against live 
also includes PDU SMS Dumb Fuzz testing targets, this is a 

R&D Tool). 

is an automated system developed by JTRIG CITD to support JTRIG BUMPERCAR 

°P®''^^'°"^ BUMPERCAR operations are used to disrupt and deny Internet-based terror ^ . . 
BUMPERCAR+ Ready to fire, 

videos or other material. The technique employs the services provided by upload providers 

to report offensive materials. 
BOMB BAY Is the capability to Increase website hits/rankings. 

BADGER mass delivery of email messaging to support an Information Operations campaign 
BURLESQUE is the capability to send spoofed SMS text messages. 
CANNONBALL is the capability to send repeated text messages to a single target. 



[Tech Lead: 
Expert User:] 

JTRIG Software 
Developers lO 



In Development. 

Ready to fire. 
Ready to fire. 
Ready to fire. 



[Tech Lead:| 

JTRIG OSOt^ 
JTRIG OSO ^ 
JTRIG OSOS 
[Tech Lead: 



CLEAN 
SWEEP 



CLUMSY 
BEEKEEPER 



Masquerade Facebook Wall Posts for individuals or entire countries 



Some work in progress to investigate IRC effects. 



Ready to fire 
(SIGINT sources Expert User: 
required) 



CHINESE 
FIRECRACKER 



Overt brute login attempts against online forums 



CONCRETE is the capability to scatter an audio message to a large number of telephones, or 
DONKEY repeatedly bomb a target number with the same message. 



NOT READY TO 
FIRE. 

Ready to fire. 
In development. 



Tech Lead 




DEER 
STALKER 



Ability to aid-geolocation of Sat Phones / GSM Phones via a silent calling to the phone. Ready to fire. 



User : 
FIPECPACKEPI3 



[Tech Lead: 
Expert User:! 



GATEWAY 
GAMBIT 



GESTATOR 



Ability to artificially increase traffic to a website 
Deployable pocket-sized proxy server 

amplification of a given message, normally video, on popular multimedia websites 
(Youtube). 



GLITTERBALL Online Gaming Capabilities for Sensitive Operations. Currently Second Life. 
For connecting two target phone together in a call. 



IMPERIAL 
BARGE 



PITBULL 



POISONED 
DAGGER 



Capability, under development, enabling large scale delivery of a tailored message to 
users of Instant Messaging services. 

Effects against Gigatribe. Built by ICTR, deployed by JTRIG. 



R e ady to f i re . JTF' I G O S O ^ 
In-development JTRIG OSO ia 

[Tech Lead: ?; 
Expert User: 

In development. 
Tested. 




In development. 



Tech Lead: 



PREDATORS 


Targeted Denial Of Service against Web Sen/ers. 








ROLLING 
THUNDER 


Distributed denial of service using P2P. Built by ICTR, deployed by JTRIG. 






SCARLET 
EMPEROR 
SCRAPHEAP 
CHALLENGE 


Targeted denial of service against targets phones via call bombing. 
Perfect spoofing of emails from Blackberry targets. 


Ready to fire. 

Ready to fire, but 
see constraints. 


JTRIG Software 
Developers [i3 




SERPENTS 
TONGUE 


for fax message broadcasting to multiple numbers. 


In redevelopment. 


[Tech Lead:^^^^ 
^^^J Expert 
User^^H^I 




SILENT 
MOVIE 


Targeted denial of sen/ice against SSH services. 


Ready to fire. 


[Tech Lead: ^^^H 




SILVERBLADE 


Reporting of extremist material on DAILYMOTION. 


Ready to fire. 


[Tech Lead: ^^^1 




SILVERFOX 


List provided to industry of live extremist material files hosted on FPUs. 


Ready to fire. 


[Tech Lead:^^^| 




SILVERLORD 


Disruption of video-based websites hosting extremist content through concerted target 
discovery and content removal. 


Ready to fire. 


[Tech Lead:^^^| 
^^^jExpert User: 




SKYSCRAPER 


Production and dissemination of multimedia via the web in the course of information 
operations. 


Ready to fire. 


[Tech Lead: Section 
X; Expert Users: 
Language Team] 




SLIPSTREAM 


Ability to inflate page views on websites 


Ready to fire. 


JTRIG OSOiO 




STEALTH 
MOOSE 


is a tool that will Disrupt target's Windows machine. Logs of how long and when the effect 

is active. 


Ready to fire (but 
see target 
restrictions). 


[Tech Lead: 
Expert User: ] 




SUNBLOCK 


Ability to deny functionality to send/receive email or view material online. 


Tested, but 
operational 
limitations. 


[Tech Lead: Section 
X; Expert User^^J 




Swamp 
donkey 


is a tool that will silently locate all predefined types of file and encrypt them on a targets 
machine. 


Ready to fire (but 
see target 
restrictions). 


[Tech Lead : 




TORNADO 
ALLEY 


is a delivery method (Excel Spreadsheet) that can silently extract and run an executable 
on a target's machine. 


Ready to fire (but 
see target 
restrictions). 


FTo p h 1 a Q H ' 
|_ 1 cLi 1 LcdU . 




UNDERPASS 


Change outcome of online polls (previously known as NUBILO) 


In development. 


[Tech Lead: Section 




VIPERS 
1 UNCjUL 


is a tool that will silently Denial of Sen/ice calls on a Satellite Phone or a GSM Phone. 


Ready to fire (but 
see target 
restnctions). i 


rTo p h i o o rl ' 
|_ 1 cLiI LcctU . 

Expert User:^^^J 




WARPATH 


Mass delivery of SMS messages to support an Information Operations campaign 


Ready to fire. 


JTRIG OSOlia 





[edit] Work Flow Management 



Tool 

HOME PORTAL 

CYBER COMMAND 
CONSOLE 

NAMEJACKER 



Description Contacts 

JTRIG Software 

A central hub for all JTRIG Cerberus tools ^ 

Developers 

A centralised suite of tools, statistics and viewers for tracking current operations across the Cyber JTRIG Software 
community. Developers lia 

JTRIG Software 

A web sen/ice and admin console for the translation of usernames between networks. For use with Developers ia 
gateways and other such technologies. 



[edit] Analysis Tools 



Tool 

BABYLON 
CRYOSTAT 
ELATE 
PRIMATE 

JEDI 



Description 

is a tool that bulk queries web mall addresses and verifies whether they can be signed up for. A green tick 
indicates that the address is currently in use. Verification can currently be done for Hotmail and Yahoo. 
Is a JTRIG tool that runs against data held in NEWPIN. It then displays this data in a chart to show links 
between targets. 

is a suite of tools for monitoring target use of the UK auction site eBay (www.ebay.co.uk). These tools are 
hosted on an Internet server, and results are retreived by encrypted email. 

is a JTRIG tool that aims to provides the capability to identify trends in seized computer media data and 
metadata. 

JTRIG will shortly be rolling out a JEDI pod to every desk of every member of an Intelligence Production 
Team. The challenge is to scale up to over 1,200 users whilst remaining agile, efficent and responsive to 
customer needs. 



JILES is a JTRIG bespoke web browser 

MIDDLEMAN 
OUTWARD 



is a distributed real-time event aggregation, tip-off and tasking platform utilised by JTRIG as a middleware 
layer. 



TANGLEFOOT 



is a collection of DNS lookup, WHOIS Lookup and other network tools. 

is a bulk search tool which queries a set of online resources. This allows analysts to quickly check the 
online presence of a target. 



Contacts 

JTRIG Software 
Developers 113 
JTRIG Software 
Developers ^ 
JTRIG Software 
Developers ti3 
JTRIG Software 
Developers 
[Tech Lead;^^^^| 
Expert User: 




[Tech Lead:| 
^^^^Expert User:] 

JTRIG Software 
Developers ^ 
JTRIG Software 
Developers ^ 
JTRIG Software 
Developers lO 



is a data index and repository that provides analysts with the ability to query data collected from the 
SLAMMER Internet from various JTRIG sources, such as EARTHLING, HACIENDA, web pages saved by analysts 
etc. 



JTRIG Software 
Developers \^ 



[edit] Databases 



Tool Description 

BYSTANDER Is a categorisation database accessed via web service. 



CONDUIT 
NEWPIN 



is a database of C2C identifiers for Intelligence Community assets acting online, 
either under alias or in real name. 

is a database of C2C identifiers obtained from a variety of unique sources, and a 



suite of tools for exploring this data. 
QUINCY is an enterprise level suite of tools for the exploitation of seized media. 



Contacts 

JTRIG Software Developers 113 
JTRIG Software Developers lia 

JTRIG Software Developers 13 

[Tech Lead :^^^^^^ Expert Users: 



[edit] Forensic Exploitation 



Tool 

BEARSCRAPE 
SFL 
Snoopy 



Description 

can extract WiFi connection history (MAC and timing) when supplied with a copy of the 
registry structure or run on the box. 

The Sigint Forensics Laboratory was developed within NSA. It has been adapted by JTRIG 
as Its email extraction and first-pass analysis of seized media solution. 

is a tool to extract mobile phone data from a copy of the phone's memory (usually supplied 
as an image file extracted through FTK. 



Contacts 

[Tech Lead 
User:] 
[Tech Lead 



[Tech Lead 



Expert 




is a tool to extract data from field forensics' reports created by Celldek, Cellebrite, XRY, 
MobileHoover Snoopy and USIM detective. These reports are transposed into a Newpin XML format to 
upload to Newpin. 


[Tech Lead: 






^^^.^ is a tool developed by NTAC to search disk images for signs of possible Encryption 

products. CMA have further developed this tool to look for signs of Steganography. 1 


[Tech Lead: 





[edit] Techniques 



Tool Description 

CHANGELING Ability to spoof any email address and send email under that identity 
HAVOK Real-time website cloning technique allowing on-the-fly alterations 
MIRAGE 

SHADOWCAT End-toEnd encrypted access to a VPS over SSH using the TOR network 


Contacts 

J 1 Klo UoU 
JTRIG OSOlO 
JTRIG OSO lO 
JTRIG OSO 13 


SPACE 
ROCKET 


is a programme covering Insertion of media into target networks. CRINKLE CUT is a tool developed by ICTR- . 
CISA to enable JTRIG track Images as part of SPACE ROCKET. ' 


Tech Lead;||^^| 
^^^^^^^H Expert 

User: 


RANA 


is a system developed by ICTR-CISA providing CAPTCHA-solving via a web sen/ice on CERBERUS. This Is 
intended for use by BUMPERCAR+ and possibly in future by SHORTFALL but anyone is welcome to use it. | 


Tech Lead:^^^ 
^^^^xpert Use 


LUMP 


A system that finds the avatar name from a SecondLife AgentID 


JTRIG Software 
Developers 


GURKHAS 
SWORD 


Beaconed Microsoft Office Documents to elicite a targets IP address. 


JTRIG Software 
Developers 



[edit] Shaping and Honeypots 



Tool 


Description 


Contacts 


DEADPOOL 


URL shortening service 


JTRIG OSOia 


HUSK 


Secure one-to-one web based dead-drop messaging platform 


JTRIG OSOlO 


LONGSHOT 


File-upload and sharing website 


JTRIG osoiia 


MOLTEN-MAGMA 


CGI HTTP Proxy with ability to log all traffic and perform HTTPS Man In the Middle. 


JTRIG Software Developers 


NIGHTCRAWLER 


Public online group against dodgy websites 


JTRIG OSOlO 


PISTRIX 


Image hosting and sharing website 


JTRIG 0S0E3 


WURLITZER 


Distribute a file to multiple file hosting websites. 



JTRIG Logo.png 



Category: JTRIG 



H^^^^^^^^^^^^^^^^^Crown Copyright] ® 2008 or is held under licence from third pculles. This Information is exempt under the Freedom of Information Act 
and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ on^^^^^HHHBHHHH 

Privacy policy About GCWiki Disclaimers 



TOP SECRET STRAPICOMINT 
The maximum classification allo' 



iwed on GCWiki is TOP SECRET STRAPl COMINT. Cliclcto report inappropriate content. 



